During incident response triage, an analyst discovers a suspicious process with PID 4812 running on a Windows system. The process is listed as 'lsass.exe' but the path is 'C:\Windows\Temp\lsass.exe'. What is the most important immediate action?

B is correct because the fake lsass.exe is confirmed malware by its path (legitimate is always in System32); before terminating, documentation of the process tree, parent process, command line arguments, and file hash preserves forensic evidence while enabling proper incident escalation with full context. A is wrong because terminating immediately destroys volatile forensic evidence (process arguments, parent process, network connections, memory) before it can be collected. C is wrong because allowing known malware to continue running while waiting for SIEM correlation allows the attacker to continue operations. D is wrong because waiting for AV scan results delays response when the masquerading technique already confirms malicious intent; AV may not detect novel malware.